Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5bd8600b286caca627645bbce984fc69a70011eb
https://github.com/WebKit/WebKit/commit/5bd8600b286caca627645bbce984fc69a70011eb
Author: Dan Hecht <[email protected]>
Date: 2026-01-20 (Tue, 20 Jan 2026)
Changed paths:
A JSTests/stress/valuerep-reduction-dce-speculation-check.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGValueRepReductionPhase.cpp
Log Message:
-----------
[JSC] ValueRep reduction involving GetClosureVal, etc should preserve
speculations
rdar://157185744
https://bugs.webkit.org/show_bug.cgi?id=305862
Reviewed by Yusuke Suzuki.
ValueRep reduction phase can do transformations like:
SomeNode(Check:Number:GetClosureVal(result=JSValue) ->
SomeNode(DoubleRep:GetClosureVar(result=Double))
Effectively folding the speculation check along the edge into the
GetClosureVar node itself. Then, if SomeNode has no references, the
whole thing is eliminated by DCE. Had this transformation not occurred,
DCE would have left a Check node to preserve the speculation.
Since the GetClosure, etc are absorbing the speculation check, they
need to survive DCE so set the must generate flag.
Test: JSTests/stress/valuerep-reduction-dce-speculation-check.js
* JSTests/stress/valuerep-reduction-dce-speculation-check.js: Added.
(fn):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::attemptToMakeDoubleResultForGet):
* Source/JavaScriptCore/dfg/DFGValueRepReductionPhase.cpp:
(JSC::DFG::ValueRepReductionPhase::convertValueRepsToUnboxed):
Canonical link: https://commits.webkit.org/305916@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
